Quick answer: A forex broker facing a platform outage, account compromise, data breach or payment-provider failure needs one incident command process. Assess client money, orders and personal data while preserving evidence, containing the incident and checking notification duties. Reopening services requires business acceptance of orders, balances, access and data integrity. Reporting deadlines depend on the licensed entity, jurisdiction and incident type.
Information last verified: 21 October 2026. This is general operational planning information, not legal advice. UK examples apply only to entities within the relevant rules; check your own licence conditions and local law before implementation.
Which failures need management escalation?
Assess severity through customer outcomes. A display error is different from clients being unable to close positions, altered withdrawal instructions or leaked identity documents. A working login does not establish safety if trading records, privileged access or client-money reconciliation are compromised.
Record the occurrence, discovery and escalation times separately, with time zones. Mark unknown facts as unconfirmed and assign an investigator. Distinguish observations from assumptions so that later decisions can be reconstructed.
| Scenario | First business questions | Suggested lead |
|---|---|---|
| Platform or bridge outage | Pending orders, exposures, prices and execution consistency | Incident manager, dealing and technology |
| Administrator compromise | Affected permissions, settings, sessions and payment instructions | Security, finance and operations |
| KYC data breach | Data categories, people affected and potential harm | Privacy, legal and compliance |
| Bank or PSP failure | In-flight transfers, duplicates, settlement gaps and client balances | Finance, payments and provider owner |
| Cloud or outsourcing disruption | Service impact, alternatives and shared dependencies | Continuity and supplier management |
Stage one: command, containment and evidence
Create a decision-making command channel
Name an incident manager and deputy to coordinate technology, dealing, finance, compliance, customer support and providers. Give the role authority to escalate service restrictions, alternative processes and customer communications. Establish an authenticated alternative channel if corporate email or messaging is affected.
Coordinate containment with evidence preservation
Follow approved procedures to restrict affected access while retaining relevant logs, configurations, activity records and snapshots. Evidence copies need access controls, timestamps and a custody record. Assess evidential consequences before rebuilding systems or overwriting logs. Record emergency changes, decision-makers and business consequences so recovery does not erase the incident history.
Protect money and trading state in parallel
Finance and dealing should independently reconcile bank, PSP, client ledger and platform records. Apply additional verification to suspicious instructions. Authorised managers should assess and document whether particular trading or withdrawal services need temporary restrictions, with continuing review. After recovery, check for missing, duplicate or out-of-sequence instructions.
Stage two: map notification obligations
The UK Financial Conduct Authority’s operational incident reporting page distinguishes current practice from the framework effective on 18 March 2027. At this article’s verification date, affected firms must still assess existing obligations. This UK example is not a common reporting regime for every offshore brokerage.
| Recipient | Assessment | Records |
|---|---|---|
| Financial regulator | Affected licensed entity and applicable reporting trigger | Rule basis, discovery time, initial and follow-up reports |
| Data-protection authority | Applicable law, personal-data risk and threshold | Risk assessment, data categories and affected population |
| Customers and counterparties | Required customer action and contractual notification | Approved versions, channels and publication times |
| Banks, PSPs and liquidity providers | Settlement, authority, connectivity and reconciliation impact | Tickets, contacts, instructions and acknowledgements |
| Insurers, law enforcement and cyber authorities | Policy conditions, suspected crime and local procedure | Assessment, evidence handover and receipts |
Where the relevant UK data-protection rules apply, the ICO requires prompt notification of a personal-data breach likely to risk people’s rights and freedoms, within 72 hours of awareness where feasible. High risk can also require informing affected people without undue delay. That period is not a universal waiting period for financial-regulator notifications. Provide reliable initial facts and supplement them as investigation progresses.
Prepare an initial report that supports updates
Identify the entity, services, clients, systems and money affected. Separate confirmed facts, open questions, containment measures and the next update time. Use one master incident identifier to connect internal logs, supplier tickets and regulatory correspondence. Label customer counts, losses and recovery times as estimates when appropriate, explaining the basis and uncertainty.
- Record service restoration separately from completion of the impact investigation.
- Explain whether customers can trade, close positions, view balances and withdraw.
- Identify potential exposure of personal data, credentials, authorisations or client money.
- List dependencies and information confirmed by providers.
- Show new facts, corrected conclusions and owners of outstanding actions in each update.
Stage three: business acceptance before reopening
A healthy technology dashboard alone does not establish safe recovery. Validate availability, integrity and access for each service. The NCSC incident-management approach connects preparation, people, technical capabilities and recovery plans. Brokers can adapt those principles by including transaction and money reconciliation in their own recovery gates.
| Acceptance area | Check | Release evidence |
|---|---|---|
| Orders and positions | Compare platform, bridge and liquidity-provider records | Pending instructions addressed and discrepancies assessed |
| Balances and settlement | Compare ledger, bank and PSP records | Gaps, in-flight transfers and duplicates explained |
| Accounts and access | Review privileged activity, sessions and credential handling | Suspicious access contained and key activity traceable |
| Data and backups | Validate recovery point and essential records | Approved data-gap and reconstruction plan |
| Customer communications | Compare status, restrictions and complaint channels | Support guidance matches actual service state |
Budget, rehearse and contract in advance
Planning costs include log retention, tested backup recovery, on-call coverage, forensic support, legal and privacy assessment, customer communication and trading-discrepancy resolution. These are budgeting categories, not prescribed regulatory fees. Set recovery objectives around services, dependencies and customer harm, then validate them through exercises rather than promising untested restoration times.
Provider contracts should address incident notification, evidence access, subcontractors, recovery assistance and exit. Rehearse scenarios such as a restored platform with an unavailable PSP, or healthy infrastructure with inconsistent client ledgers. Test cross-team decisions as well as backup restoration. Link this work to your outsourcing controls and ongoing compliance programme.
Frequently asked questions
Does every short outage require regulatory reporting?
Assess the entity’s applicable rules and actual impact. Duration is only one factor: trading, money, data and system control can matter. Record the reason for reporting or deciding that reporting is not required.
Should we wait for a final root cause before reporting?
Do not miss an applicable notification requirement while waiting for a final investigation. Provide reliable facts, open questions and the next update time, then supplement the report.
Does a 72-hour deadline apply to every cyber incident?
No. The example concerns particular UK personal-data breach rules with scope and risk conditions. Financial-regulator, contractual and other countries’ duties need separate assessment.
Can we close an incident when a provider says it is resolved?
Provider confirmation is insufficient by itself. The broker should verify customer impact, orders, money, access and data integrity, with acceptance by an authorised manager.
Can all services reopen immediately after backup restoration?
Validate recovery points, data discrepancies, duplicate instructions and affected permissions first. Reopen in stages according to acceptance results and continue monitoring.
Are the FCA’s 2027 reporting rules already effective?
As of 21 October 2026, the new framework is due to take effect on 18 March 2027. Firms remain subject to their existing applicable notification obligations.
Does a small broker need a standalone security team?
Staffing can reflect scale and risk, but named owners, deputies, external support, evidence access and decision rights are needed. Outsourcing technical support does not remove the licensed entity’s management responsibility.
To incorporate response planning, outsourcing and regulatory reporting into your operating model, contact our team with your licensing jurisdiction, systems and business model.
Discuss Your Licensing and Business Needs
Tell us what you need and our team will contact you shortly.